CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
Paris, on February 3, 2022
Letter with acknowledgment of receipt
No:
To be quoted in all correspondence:
Ref. No.: MDM2
Formal notice no. MED 2022-003 of February 3, 2022
Case no.
Dear Sir or Madam,
I am following up on the complaint from which was forwarded to the French data protection authority (CNIL) by the data protection authority in Luxembourg ("the Commission nationale pour la protection des données du Grand-Duché de Luxembourg (CNPD)") pursuant to the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
lodged a complaint with his data protection authority against the company publisher of the website established in France, concerning the difficulties encountered in the exercise of his rights of erasure and objection. In this case, the complainant requested the deletion of his personal data linked to his e-mail addresses « » and « » by a first e-mail of 27 May 2020 sent to the contact address « » then by a follow-up email sent on 11 June 2020.
The elements communicated to the Commission in the email dated 10 February 2021 in the context of the investigation of this complaint give rise to the following observations.
Firstly, indicated to my services that he had tried to unsubscribe from marketing emails using the link at the bottom of them, without success.
It was indicated that this link works in principle, that it is managed manually and that the possible failure to act on the complainant's request might result from the disorganisation of your services due to the health crisis.
Secondly, it was specified that only the e-mail address was registered in s customer databases. It was then indicated that the complainant's request generated an acknowledgment of receipt from the IT department on 15 June 2020 and that his email address was actually deleted on the following 16 June but that the IT department, which acknowledged receipt of the complainant's request, supposedly "inadvertently forgot to confirm to him that it had done what was necessary". However, it was brought to our attention that the complainant is said to have received a marketing email on 29 July 2020 sent through " (copy attached). The Commission nationale pour la protection des données du Grand-Duché de Luxembourg also informed us that the complainant then would have received a marketing email in October 2020.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant ou délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
Yet, I remind you that any individual can request at any time the erasure of personal data concerning them (articles 17 and 21.1 of the GDPR).
Thus, it appears that the complainant's personal data would not have been suppressed from the [REDACTED]'s files on 16 July of 2020 as it was mentioned in the letter of 10 February received by the Commission.
Then, when my services tried to reach your services using the contact email address "[REDACTED]", which was indicated on your website as being the address for exercising the rights of data subjects, they received the response below (screenshot).
Nous ne pouvons répondre favorablement à votre demande.
Veuillez écrire à votre restaurant en vous rendant sur notre site [REDACTED] rubrique « Contactez nous », en choisissant "Contactez votre restaurant", ou joindre votre restaurant par téléphone.
Translation of the screenshot: "Wednesday 13/01/2021 15:35, [REDACTED]. Auto: Complaint n' [REDACTED] to [REDACTED]. We cannot respond favorably to your request. Please write to your restaurant by visiting our website [REDACTED] section "Contact us", choosing "Contact your restaurant", or contact your restaurant by phone."
I am surprised by the answer of your services dated February 10, 2021 n which it was indicated that "the automatic response message generated by the address [REDACTED]" indicates, in fact, not "we cannot respond favorably to your request" as stated in [our] letter, but the following: "Hello, This address is not dedicated to receiving messages. If you wish to write to your [REDACTED] restaurant, we invite you to go to the "Contact us" section, [REDACTED] of our website. Then choose "Contact your restaurant" and select the city of your restaurant or do not hesitate to contact your restaurant directly by phone. [...]".
I remind you that you must facilitate the exercise of the rights of data subjects (article 12.2 of the GDPR).
Thus, referring people to the "Contact us" form on the website, while they are exercising their rights via the contact email address made available to them for this purpose, does not facilitate the exercise of the rights of the data subjects.
Thenceforth, you have to set up an intelligible system to facilitate the exercise of all rights available to data subjects under the GDPR.
In addition, you must "provide the data subject with information on the measures taken following a request made in accordance with Articles 15 to 22, as soon as possible and in any event within one month from receipt of the request", this period may be extended by two months due to the complexity and number of requests, and on condition that the data subjects are informed of this extension and the reasons for the postponement (article 12.3 of the GDPR).
Thus, you shall inform all applicants that that their request for erasure has been taken into account within one month, or in the event of difficulties caused by the complexity or number of requests, within two months provided that you informed the applicant about this extension and the reasons for this postponement.
Consequently, pursuant to Article 20 of the French law no. 78-17 of January 6, 1978 as amended and to Article 58.2.c of the general data protection regulation, and in agreement with other data protection authorities concerned by the processing, the company [REDACTED] located at [REDACTED], is hereby given order to comply, within twenty (20) days from notification of this decision and subject to measures that it may already have adopted, to:
- proceed to the erasure of all personal data concerning [REDACTED];
- inform [REDACTED] that his erasure and opposition requests have been taken into account;
- take the necessary measures to set up an intelligible system to facilitate the exercise of all rights available to data subjects under the GDPR;
- justify to the CNIL that these requests have been complied with, within the time limit set.
After this time-limit, if the company [REDACTED] has complied with this order to comply, I will address it a letter for informing it that this formal notice procedure is closed.
On the contrary, if the company [REDACTED] has not complied with this order to comply, I could seize CNIL4S Restricted Committee in order for one or several of the measures set out under Article 20 and subsequent of French law of January 6th, 1978 as amended to be pronounced.
I also draw your attention to the retention period of the personal data for which you indicate that you do not keep personal data of your prospective customers after a period of 36 months following the last contact. However, the complainant indicated that his last purchase from your service was 4-5 years ago. This last contact dates back more than 36 months. In this respect, we recall that the GDPR (Article 5.1 e) specifies that personal data must be "kept in a form which permits identification of individuals for no longer than is necessary for the purposes for which the personal data is processed".
The Commission's services [REDACTED], legal officer in the rights and complaint department - [REDACTED] are at your disposal for any further information.
This decision may be appealed before the French State Council within two months a period of following its notification.
Yours sincerely,
De:
Envoyé:
À:
Objet:
mercredi 29 juillet 2020 14:00
1
2